Does Microsoft Copilot Studio sign a BAA?
Yes, it signs a BAA
Microsoft says Copilot Studio is covered under its HIPAA BAA, which commercial customers who are covered entities or business associates get by default through the Data Protection Addendum. Copilot Studio is still not intended for use as a medical device.
- Business associate
- Microsoft
- Tool
- Microsoft Copilot Studio
- Plans with a BAA
- Copilot Studio (commercial Online Service licenses)
- Checked
Signs a BAA
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Copilot Studio (commercial Online Service licenses) | Signs a BAA | Included in the terms | The Microsoft BAA comes by default through the Online Services Data Protection Addendum for HIPAA covered entities and business associates. Copilot Studio agents can collect and handle PHI when the organization is bound by HIPAA.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Microsoft says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Copilot Studio agents (conversations capturing health information) | Covered | Microsoft's examples include agents that ask for and capture health details such as blood pressure or weight.[1] |
| Web search / Bing grounding and external connectors | Not stated | The Copilot Studio compliance page lists no exclusions, and the data-handling pages for web search could not be fetched.[1] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.